Packagist/typo3/cms-filelist CVE-2026-49742: high 7.1, EPSS 0.31%
TYPO3 CMS has Broken Access Control in its Media Module
Action: Upgrade typo3/cms-filelist to 11.5.51 or later.
composer require typo3/cms-filelist:11.5.51composer require typo3/cms-filelist:12.4.46composer require typo3/cms-filelist:13.4.31composer require typo3/cms-filelist:14.3.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 11.0.0 | 11.5.51 | - |
| 12.0.0 | 12.4.46 | - |
| 13.0.0 | 13.4.31 | - |
| 14.0.0 | 14.3.3 | - |
Fixed versions
| 11.5.51 | 12.4.46 | 13.4.31 | 14.3.3 |
Sources
- osv: GHSA-chm7-4vch-h8vr#Packagist/typo3/cms-filelist
- nvd: CVE-2026-49742
- https://github.com/TYPO3/typo3/security/advisories/GHSA-chm7-4vch-h8vr
- https://github.com/TYPO3/typo3/commit/ad636b6183843b57c758a1e12174a75093ac93c3
- https://github.com/TYPO3/typo3/commit/caa6b444d7ab1bdd1eb76a68004c8be73d98e6ae
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-49742.yaml
- https://github.com/TYPO3/typo3
- https://typo3.org/security/advisory/typo3-core-sa-2026-013
CVE-2026-49742 · published · modified · JSON